Vulnerability Details : CVE-2014-7277
Cross-site scripting (XSS) vulnerability in the login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified "welcome message" form data that is improperly handled during rendering of the loginMessage list item, a different vulnerability than CVE-2014-7278.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2014-7277
- cpe:2.3:o:zyxel:sbg3300-n_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:h:zyxel:sbg3300-n:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-7277
0.30%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-7277
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2014-7277
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-7277
-
http://www.securityfocus.com/bid/70232
Zyxel SBG-3300 Series Routers CVE-2014-7277 HTML Injection Vulnerability
-
http://packetstormsecurity.com/files/128551/ZyXEL-SBG-3300-Security-Gateway-Cross-Site-Scripting.html
ZyXEL SBG-3300 Security Gateway Cross Site Scripting ≈ Packet Storm
-
http://seclists.org/fulldisclosure/2014/Oct/19
Full Disclosure: CVE-2014-7277 Stored Server XSS in ZyXEL SBG-3300 Security Gateway
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/96891
ZyXEL SBG-3300 Security Gateway cross-site scripting CVE-2014-7277 Vulnerability Report
-
http://archives.neohapsis.com/archives/bugtraq/2014-10/0024.html
Exploit
Jump to